瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 帮忙看下 给个解决方法(在线等)论坛么人了？？

1   1  /  1  页   跳转页

帮忙看下 给个解决方法(在线等)论坛么人了？？

收藏
挥不去的病毒
头像
初生襁褓狮
  • 帖子:37
  • 注册: 2007-02-20
  • 来自:
发表于： 2007-03-02 13:48 | 显示全部 短消息 资料
字号： 小 中 大 1楼

帮忙看下 给个解决方法(在线等)论坛么人了？？

[CODE]

2007-03-02,13:33:15

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition  (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <g3kl><C:\WINDOWS\servicer.exe>  [N/A]
    <mdb2jl2g><C:\WINDOWS\c0nima.exe>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)N/A]
    <InternetEx><C:\WINDOWS\system\inetinf.exe>  [N/A]
    <upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe>  [N/A]
    <cmdbcs><C:\WINDOWS\cmdbcs.exe>  [N/A]
    <Internet><C:\WINDOWS\system\svchosi.exe>  [N/A]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>  [RealNetworks, Inc.]
    <ShStatEXE><"C:\Program Files\ePOPlice\SHSTAT.EXE" /STANDALONE>  [(Verified)McAfee, Inc.]
    <McAfeeUpdaterUI><"C:\Program Files\Common Framework\UdaterUI.exe" /StartedFromRunKey>  [(Verified)McAfee, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <internet><C:\WINDOWS\system\taskmgr.exe /scan>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Corporation]
最后编辑2007-03-02 14:57:56
分享到：
gototop
 
挥不去的病毒
头像
初生襁褓狮
  • 帖子:37
  • 注册: 2007-02-20
  • 来自:
发表于： 2007-03-02 13:50 | 显示全部 短消息 资料
字号： 小 中 大 2楼

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework Service / McAfeeFramework][Running/Auto Start]
  <"C:\Program Files\Common Framework\FrameworkService.exe" /ServiceStart><McAfee, Inc.>
[McAfee McShield / McShield][Running/Auto Start]
  <"C:\Program Files\ePOPlice\Mcshield.exe"><McAfee, Inc.>
[McAfee Task Manager / McTaskManager][Running/Auto Start]
  <"C:\Program Files\ePOPlice\VsTskMgr.exe"><McAfee, Inc.>

==================================
驱动程序
[AliIde / AliIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[MegaIDE / MegaIDE][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[McAfee Inc. / mfeapfk][Running/Manual Start]
  <system32\drivers\mfeapfk.sys><McAfee, Inc.>
[McAfee Inc. / mfeavfk][Running/Manual Start]
  <system32\drivers\mfeavfk.sys><McAfee, Inc.>
[McAfee Inc. / mfebopk][Running/Manual Start]
  <system32\drivers\mfebopk.sys><McAfee, Inc.>
[McAfee Inc. / mfehidk][Running/Manual Start]
  <system32\drivers\mfehidk.sys><McAfee, Inc.>
[VSCore mferkdk / mferkdk][Running/System Start]
  <\??\C:\Program Files\ePOPlice\mferkdk.sys><McAfee, Inc.>
[McAfee Inc. / mfetdik][Running/System Start]
  <system32\drivers\mfetdik.sys><McAfee, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>

==================================
浏览器加载项
[Flash 9b]
  {492B8F66-B8CF-4F7A-B0EE-B7383B92F5BA} <C:\WINDOWS\system\IceHBO.dll, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Update Class]
  {9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINDOWS\system32\iuctl.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
gototop
 
挥不去的病毒
头像
初生襁褓狮
  • 帖子:37
  • 注册: 2007-02-20
  • 来自:
发表于： 2007-03-02 13:51 | 显示全部 短消息 资料
字号： 小 中 大 3楼

=================================
正在运行的进程
[PID: 376][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 432][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 456][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 500][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 512][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 644][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 708][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 848][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 880][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 892][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1028][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1056][C:\WINDOWS\system32\msdtc.exe]  [Microsoft Corporation, 2001.12.4720.0 (srv03_rtm.030324-2048)]
[PID: 1184][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1208][C:\Program Files\Common Framework\FrameworkService.exe]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\nailog.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naXML71.dll]  [N/A, N/A]
    [C:\Program Files\Common Framework\NaiSign.DLL]  [N/A, N/A]
    [C:\WINDOWS\system32\epoPGPSDK.dll]  [PGP Corporation, 3.5.3]
    [C:\Program Files\Common Framework\naCmnLib71.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\applib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\0409\AgentRes.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\Logging.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\InternetManager.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naInet.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\UserSpace.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\SecureFrameworkFactory.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\Management.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\cmalib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naPolicyManager.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\ScriptSubSys.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\UpdateSubSys.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\Scheduler.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\TCSubSys.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\GenEvtInf.dll]  [McAfee, Inc., 3.6.0.453]
[PID: 1292][C:\Program Files\ePOPlice\Mcshield.exe]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\LockDown.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus2.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\RES0402\McShield.dll]  [McAfee, Inc., VSCORE.13.3.1.100]
    [C:\Program Files\ePOPlice\FTL.Dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\naiann.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\VsEvntUI.dll]  [N/A, N/A]
    [C:\Program Files\ePOPlice\NAEvent.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\shutil.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\wmain.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\Common Framework\GenEvtInf.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\SecureFrameworkFactory.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\ePOPlice\scriptsv.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mfebopa.dll]  [McAfee, Inc., SYSCORE.13.3.0.116.x86]
    [C:\Program Files\ePOPlice\mfehida.dll]  [McAfee, Inc., SYSCORE.13.3.0.116.x86]
    [C:\Program Files\ePOPlice\mfeapfa.dll]  [McAfee, Inc., SYSCORE.13.3.0.116.x86]
    [C:\Program Files\ePOPlice\mfeavfa.dll]  [McAfee, Inc., SYSCORE.13.3.0.116.x86]
    [C:\Program Files\Common Files\McAfee\Engine\mcscan32.dll]  [McAfee, Inc., 5.1.00]
gototop
 
挥不去的病毒
头像
初生襁褓狮
  • 帖子:37
  • 注册: 2007-02-20
  • 来自:
发表于： 2007-03-02 13:51 | 显示全部 短消息 资料
字号： 小 中 大 4楼

[PID: 1320][C:\Program Files\ePOPlice\VsTskMgr.exe]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\LockDown.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus2.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\shutil.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\wmain.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\condl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\RES0402\McShield.dll]  [McAfee, Inc., VSCORE.13.3.1.100]
    [C:\Program Files\ePOPlice\MIDUtil.Dll]  [McAfee, Inc., 8.5.0.148]
    [C:\Program Files\ePOPlice\BBCpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\coptcpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\EmCfgCpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\nvpcpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\ftcfg.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\OASCpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\QuarCpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\vsodscpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\VsEvntUI.dll]  [N/A, N/A]
    [C:\Program Files\ePOPlice\NAEvent.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\ftl.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\vsupdcpl.dll]  [McAfee, Inc., 8.5.0.781]
[PID: 1408][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1404][C:\Program Files\Common Framework\naPrdMgr.exe]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\NaiSign.DLL]  [N/A, N/A]
    [C:\WINDOWS\system32\epoPGPSDK.dll]  [PGP Corporation, 3.5.3]
    [C:\Program Files\Common Framework\naXML71.dll]  [N/A, N/A]
    [C:\Program Files\Common Framework\nailog.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naCmnLib71.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\applib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\0409\AgentRes.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\ePOPlice\VsPlugin.dll]  [McAfee, Inc., 8.5.0.781]
[PID: 1448][C:\WINDOWS\system32\Dfssvc.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1756][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [C:\WINDOWS\system32\cmdbcs.dll]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\Program Files\Common Framework\JrMac.dll]  [McAfee, Inc., 1.0.0.125]
    [C:\Program Files\ePOPlice\shext.dll]  [McAfee, Inc., 8.5.0.781]
[PID: 1812][C:\WINDOWS\system\taskmgr.exe]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 1856][C:\WINDOWS\system\inetinf.exe]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 1900][C:\WINDOWS\system\svchosi.exe]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
[PID: 1908][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.1622]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
gototop
 
挥不去的病毒
头像
初生襁褓狮
  • 帖子:37
  • 注册: 2007-02-20
  • 来自:
发表于： 2007-03-02 13:52 | 显示全部 短消息 资料
字号： 小 中 大 5楼

[PID: 1932][C:\Program Files\ePOPlice\SHSTAT.EXE]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\LockDown.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\ftcfg.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\mytilus2.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\wmain.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\shutil.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\RES0402\McShield.dll]  [McAfee, Inc., VSCORE.13.3.1.100]
    [C:\Program Files\ePOPlice\Graphics.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
[PID: 1948][C:\Program Files\Common Framework\UdaterUI.exe]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\nailog.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naCmnLib71.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naXML71.dll]  [N/A, N/A]
    [C:\Program Files\Common Framework\NaiSign.DLL]  [N/A, N/A]
    [C:\WINDOWS\system32\epoPGPSDK.dll]  [PGP Corporation, 3.5.3]
    [C:\Program Files\Common Framework\applib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\cmalib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\0409\UpdRes.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\0409\AgentRes.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\SecureFrameworkFactory.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
[PID: 1956][C:\SysWsj\svchost.exe]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
[PID: 1968][C:\SysDayN\svchost.exe]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 1992][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 2000][C:\Program Files\Common Framework\McTray.exe]  [McAfee, Inc., 1.0.0.125]
    [C:\Program Files\Common Framework\JrMac.dll]  [McAfee, Inc., 1.0.0.125]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 188][C:\WINDOWS\servicer.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
[PID: 252][C:\WINDOWS\c0nime.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
[PID: 1836][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 2568][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2996][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 3024][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 3640][C:\Documents and Settings\Administrator\Local Settings\Temp\sreng2.zip 的临时目录 2\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
gototop
 
挥不去的病毒
头像
初生襁褓狮
  • 帖子:37
  • 注册: 2007-02-20
  • 来自:
发表于： 2007-03-02 13:52 | 显示全部 短消息 资料
字号： 小 中 大 6楼

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[D:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[F:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[G:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]
gototop
 
挥不去的病毒
头像
初生襁褓狮
  • 帖子:37
  • 注册: 2007-02-20
  • 来自:
发表于： 2007-03-02 14:11 | 显示全部 短消息 资料
字号： 小 中 大 7楼

顶顶
gototop
 
挥不去的病毒
头像
初生襁褓狮
  • 帖子:37
  • 注册: 2007-02-20
  • 来自:
发表于： 2007-03-02 14:25 | 显示全部 短消息 资料
字号： 小 中 大 8楼

没人懂吗?
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT